Wallet addresses explained

Why Bitcoin addresses change

New Bitcoin users often assume something has gone wrong when their wallet shows a different receiving address than last time. Nothing has. It is deliberate and it is a privacy feature.

Bitcoin wallets are hierarchical deterministic — every address is derived from your single recovery phrase along a numbered path, so the wallet can generate an effectively unlimited supply of them. It hands out a fresh one for each incoming payment because reusing a single address lets anyone watching the public chain link all your payments together, building a picture of your income, your counterparties and your total holdings.

Every address your wallet has ever generated remains yours and remains usable forever. Funds sent to an address from two years ago will still arrive and still appear in your balance, because your recovery phrase derives all of them. There is no expiry.

Account-based chains work differently. Ethereum, Solana, XRP and most others use a single persistent address per account, so yours does not change. That is simpler and it is worse for privacy — every transaction you ever make is publicly linked to the same identifier. See our traceability guide for what that exposes.

Finding and verifying yours

Getting the address is trivial. Verifying it is the part that matters, and it takes fifteen seconds.

Get it fresh from the wallet. Open your wallet, select the asset, choose receive. Never take an address from a transaction history, an old email, a chat message, a screenshot or a note — all of those are exactly where an attacker would like you to find one.

Confirm it on the device's own screen. If you have a hardware wallet, its receive flow displays the address on a screen driven by the device's firmware, which malware on your computer cannot alter. Compare it against what your computer shows — the start, the middle and the end, not just the first four characters. This is the specific defence against clipboard-hijacking malware, and it is why we treat screen size as a security feature when grading devices: a Trezor Safe 5's colour touchscreen genuinely produces more careful checking than a two-line display does.

Use the QR code where you can. Scanning eliminates the clipboard entirely, which removes the attack surface rather than defending it. Where the sending side supports a camera, prefer it.

Then send a small test amount. Ten or twenty dollars, confirm it arrives, then send the rest. If verification failed for any reason, this is what limits the damage. Full walkthrough in our withdrawal guide.

What an address reveals about you

Sharing an address is safe from a theft perspective and not neutral from a privacy perspective, and the distinction is worth understanding.

Anyone with your address can see, on a public block explorer, its complete balance and its entire transaction history — every amount received, every amount sent, every counterparty address, with timestamps. This is permanent and cannot be deleted.

Beyond that, analysis techniques can group addresses that are probably controlled by the same person. If you spend coins from two addresses in a single transaction, you have demonstrated control of both, and clustering software records that. Over time this builds a picture considerably larger than any single address suggests.

The practical consequence for New Zealanders: if you give one address to an employer, a client or a friend, you have potentially shown them more than you intended — not just the payment, but everything else that address has done and, through clustering, possibly other addresses too. Use a fresh address per counterparty where the chain supports it, and read our tracking guide for the fuller picture and what can and cannot be linked to a real identity.

The four address mistakes that cost money

Wrong network. The single most common expensive error. The address was valid, the chain was wrong. An 0x address is valid on Ethereum, Base, Arbitrum, Polygon and BNB Chain simultaneously, so nothing warns you. Whatever network your wallet's receive screen names, select exactly that.

Address taken from history. Address poisoning works by sending you a tiny transaction from a look-alike address so that it appears in your history. Later you copy the recipient from there. Always get it fresh.

Clipboard substitution. Malware swaps the copied address for the attacker's, matching the first and last characters. Verify on a device screen, or scan a QR code, or send a test amount — ideally all three.

Missing memo or destination tag. XRP, several Cosmos chains and most exchange deposit addresses use a shared address plus a memo to identify the account. Omit it and the funds arrive with no indication of whose they are. Personal wallet addresses generally need no memo; only include one when the destination gives you one.